Kerberos on Windows. Usage of existing tickets and logon context

[stephanbertl]

I have a question about Kerberos on Windows. We are a windows shop so Trino is used from Windows PCs using either JDBC client or Trino-CLI. I could not find anything in the documentation that describes using existing Kerberos tickets on windows.

For example in the Trino CLI, is it possible to use the current logon context without specifying usernames and/or keytab files? Technically in Java this is possible. The same goes for the JDBC client, for example it would be fantastic to use the windows logon context in tools like Jetbrains DataGrip.

If this isnt possible, would you accept pull requests for that feature? I am currently trying to compile trino on windows to look into the code.

[hashhar]

IIRC if the credential cache is primed the client should be able to reuse the tickets from there.

On non-Windows the ticket cache does work properly IIRC.

If you do run into issues please include krb debug logs from the JVM in addition to server logs - hard to do anything about kerberos with just the error messages.

[stephanbertl]

@hashhar the kinit kerberos cache does indeed work on windows. But native GSS doesn't. I have looked into it a bit and proposed a fix that works: #23971